linux-kernel - Re: [PATCH] security: smack: Add support automatic Smack labeling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-id: <1441029540.2335.2.camel@samsung.com>
Date:	Mon, 31 Aug 2015 15:59:00 +0200
From:	Lukasz Pawelczyk <l.pawelczyk@...sung.com>
To:	jonghwa3.lee@...sung.com, Casey Schaufler <casey@...aufler-ca.com>,
	linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org
Cc:	james.l.morris@...cle.com, serge@...lyn.com,
	sangbae90.lee@...sung.com, inki.dae@...sung.com
Subject: Re: [PATCH] security: smack: Add support automatic Smack labeling

On pon, 2015-08-31 at 15:13 +0900, jonghwa3.lee@...sung.com wrote:
> A rule is defined for a process, 'process A',  in smack rule table.
> 
> ...
> Process A    device::A    arwx-
> ...
> 
> The object 'device::A' will be used to a device node that 'process A'
> will access.
> However when the target device node is created  it's labeled with
> default label
> which is inherited from any of filesystem, ancestor,  or creating
> process.
> Let's say the default object label for devtmpfs is '_' which allows
> only read and
> write access. So we need the specific labeling by the authorized
> process as like
> udevd for the devtmpfs.
> 
> In normal, smack label and access control follow the sequences,
> 
> 1. Kernel module driver loaded
> 2. New device node is created  (/dev/aaa ,  '_')
> 3. Udevd gets uevent and appies udev rule (/dev/aaa, 'device::A')
> 4. 'Process A' accesses the device node ('Process A' --->
> 'device::A', MAY_WRITE)
> 5. Access is permitted.
> 
> However, when labeling isn't done in proper time, result will be
> different,
> 
> 1. Kernel module driver loaded
> 2. New device node is created  (/dev/aaa ,  '_')
> 3. 'Process A' accesses the device node ('Process A' ---> '_',
> MAY_WRITE)
> 4. Access is prohibited
> 
> Can this situation be handled in current Smack subsystem?
> If so, could you give me an idea how to handle it.

This doesn't seem to be a Smack problem. This isn't even a kernel
problem. It's userspace race. You should wait for a proper udev event
that notifies after all udev rules are applied.

I think there are 2 udev events. One that notifies that a device has
been added. Second that notifies where all the rules for the device has
been applied. You need to use the second one.



-- 
Lukasz Pawelczyk
Samsung R&D Institute Poland
Samsung Electronics




--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/